docs: define npm publish automation policy

[salim4n]

Summary

• make the npm alpha publication policy explicit: manual-only for v0.1.0-alpha.x, no automatic publish workflow, no long-lived NPM_TOKEN, and mandatory --tag alpha
• document future automation requirements: dedicated PR, Trusted Publishing/OIDC, manual approval gate, explicit prerelease tag, and pack/dry-run proof
• update release, runbook, readiness, audit, and backlog docs for PR docs: define npm publish automation policy #49 and the next CLI/environment PR

Validation

• bun run lint
• bun run typecheck
• bun run test
• bun run build
• bun run pack:check
• git diff --check